Skip to content

Commit c3639a3

Browse files
DarthSimDarthSim
committed
Remove loading env vars from Secret Manager; Add default path for Systems Manager Parameter Store
1 parent 082ac98 commit c3639a3

2 files changed

Lines changed: 83 additions & 103 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
# Changelog
22

3+
## [Unreleased]
4+
### Added
5+
- Added `HowToConfigure` output.
6+
7+
### Changed
8+
- If the `EnvironmentSystemsManagerParametersPath` parameter is not set, use `/${AWS::StackName}` as the default value.
9+
10+
### Removed
11+
- Removed the `EnvironmentSecretARN` and `EnvironmentSecretVersionID` parameters.
12+
313
## [0.1.0] - 2024-01-14
414
### Added
515
- Script to generate CloudFormation templates.

‎template.py‎

Lines changed: 73 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
import awacs.cloudformation as actions_cloudformation
2525
import awacs.logs as actions_logs
2626
import awacs.cloudwatch as actions_cloudwatch
27-
import awacs.secretsmanager as actions_secretsmanager
2827
import awacs.ssm as actions_ssm
2928
import awacs.kms as actions_kms
3029
import awacs.aws_marketplace as actions_marketplace
@@ -130,10 +129,7 @@ def __init__(self, value_one: object, value_two: object) -> None:
130129
network_params_group = "Network"
131130
cluster_params_group = "Cluster"
132131
service_params_group = "Service"
133-
environment_secret_params_group = \
134-
"Load environment from an AWS Secrets Manager secret"
135-
environment_systems_manager_params_group = \
136-
"Load environment from AWS Systems Manager Parameter Store"
132+
configuration_params_group = "imgproxy Configuration"
137133
s3_params_group = "S3 integration"
138134
endpoint_params_group = "Endpoint"
139135

@@ -344,50 +340,21 @@ def __init__(self, value_one: object, value_two: object) -> None:
344340
template.add_parameter_to_group(task_max_count, service_params_group)
345341
template.set_parameter_label(task_max_count, "Maximum number of tasks")
346342

347-
# Secret manager ---------------------------------------------------------------
348-
349-
environment_secret_arn = template.add_parameter(Parameter(
350-
"EnvironmentSecretARN",
351-
Type="String",
352-
Description=("ARN of an AWS Secrets Manager secret containing environment variables. See"
353-
" https://docs.imgproxy.net/latest/configuration/loading_environment_variables#environment-file-syntax" # noqa: E501
354-
" for the secret syntax. See https://docs.imgproxy.net/configuration for supported"
355-
" environment variables"),
356-
Default="",
357-
))
358-
template.add_parameter_to_group(environment_secret_arn,
359-
environment_secret_params_group)
360-
template.set_parameter_label(environment_secret_arn,
361-
"Secrets Manager secret ARN (optional)")
362-
363-
environment_secret_version_id = template.add_parameter(Parameter(
364-
"EnvironmentSecretVersionID",
365-
Type="String",
366-
Description=("Version ID of the AWS Secrets Manager secret containing environment variables."
367-
" If not set, the latest version is used"),
368-
Default="",
369-
))
370-
template.add_parameter_to_group(environment_secret_version_id,
371-
environment_secret_params_group)
372-
template.set_parameter_label(environment_secret_version_id,
373-
"Secrets Manager secret version ID (optional)")
374-
375-
# Systems manager --------------------------------------------------------------
343+
# Configuration ----------------------------------------------------------------
376344

377345
environment_systems_manager_parameters_path = template.add_parameter(Parameter(
378346
"EnvironmentSystemsManagerParametersPath",
379347
Type="String",
380-
Description=("A path of AWS Systems Manager Parameter Store parameters containing the"
348+
Description=("A path of AWS Systems Manager Parameter Store parameters that should be loaded as"
381349
" environment variables. The path should start with a slash (/) but should not have"
382-
" a slash (/) at the end. See"
383-
" https://docs.imgproxy.net/latest/configuration/loading_environment_variables#aws-systems-manager-path" # noqa: E501
384-
" to learn how imgproxy maps AWS Systems Manager Parameter Store parameters to"
385-
" environment variables. See https://docs.imgproxy.net/configuration for supported"
386-
" environment variables"),
350+
" a slash (/) at the end. For example, if you want to load the IMGPROXY_KEY variable"
351+
" from the /imgproxy/prod/IMGPROXY_KEY parameter, the value should be"
352+
" /imgproxy/prod. If not set, imgproxy will load environment variables from the"
353+
" /${StackName} path."),
387354
Default="",
388355
))
389356
template.add_parameter_to_group(environment_systems_manager_parameters_path,
390-
environment_systems_manager_params_group)
357+
configuration_params_group)
391358
template.set_parameter_label(environment_systems_manager_parameters_path,
392359
"Systems Manager Parameter Store parameters path (optional)")
393360

@@ -489,11 +456,6 @@ def __init__(self, value_one: object, value_two: object) -> None:
489456
IfYes(cluster_add_warm_pool),
490457
)
491458

492-
have_environment_secret_arn = template.add_condition(
493-
"HaveEnvironmentSecretArn",
494-
Not(Equals(Ref(environment_secret_arn), "")),
495-
)
496-
497459
have_environment_systems_manager_parameters_path = template.add_condition(
498460
"HaveEnvironmentSystemsManagerParametersPath",
499461
Not(Equals(Ref(environment_systems_manager_parameters_path), "")),
@@ -941,50 +903,32 @@ def __init__(self, value_one: object, value_two: object) -> None:
941903
)],
942904
),
943905
),
944-
If(
945-
have_environment_secret_arn,
946-
iam.Policy(
947-
PolicyName="secrets_manager-access",
948-
PolicyDocument=aws.PolicyDocument(
949-
Version="2012-10-17",
950-
Statement=[aws.Statement(
951-
Effect=aws.Allow,
952-
Action=[
953-
actions_secretsmanager.GetSecretValue,
954-
actions_secretsmanager.ListSecretVersionIds,
955-
],
956-
Resource=[Ref(environment_secret_arn)],
957-
)],
958-
),
959-
),
960-
NoValue,
961-
),
962-
If(
963-
have_environment_systems_manager_parameters_path,
964-
iam.Policy(
965-
PolicyName="systems_manager-access",
966-
PolicyDocument=aws.PolicyDocument(
967-
Version="2012-10-17",
968-
Statement=[aws.Statement(
969-
Effect=aws.Allow,
970-
Action=[
971-
actions_ssm.GetParametersByPath,
906+
iam.Policy(
907+
PolicyName="systems_manager-access",
908+
PolicyDocument=aws.PolicyDocument(
909+
Version="2012-10-17",
910+
Statement=[aws.Statement(
911+
Effect=aws.Allow,
912+
Action=[
913+
actions_ssm.GetParametersByPath,
914+
],
915+
Resource=[Join(
916+
"",
917+
[
918+
"arn:aws:ssm:",
919+
Region,
920+
":",
921+
AccountId,
922+
":parameter",
923+
If(
924+
have_environment_systems_manager_parameters_path,
925+
Ref(environment_systems_manager_parameters_path),
926+
Join("", ["/", StackName]),
927+
),
972928
],
973-
Resource=[Join(
974-
"",
975-
[
976-
"arn:aws:ssm:",
977-
Region,
978-
":",
979-
AccountId,
980-
":parameter",
981-
Ref(environment_systems_manager_parameters_path)
982-
],
983-
)],
984929
)],
985-
),
930+
)],
986931
),
987-
NoValue,
988932
),
989933
If(
990934
have_s3_objects,
@@ -1085,22 +1029,17 @@ def __init__(self, value_one: object, value_two: object) -> None:
10851029
ecs.Environment(Name="AWS_REGION", Value=Region),
10861030
ecs.Environment(Name="IMGPROXY_BIND", Value=":8080"),
10871031
ecs.Environment(Name="IMGPROXY_LOG_FORMAT", Value="structured"),
1088-
If(
1089-
have_environment_secret_arn,
1090-
ecs.Environment(Name="IMGPROXY_ENV_AWS_SECRET_ID", Value=Ref(environment_secret_arn)),
1091-
NoValue,
1092-
),
1093-
If(
1094-
have_environment_secret_arn,
1095-
ecs.Environment(Name="IMGPROXY_ENV_AWS_SECRET_VERSION_ID",
1096-
Value=Ref(environment_secret_version_id)),
1097-
NoValue,
1098-
),
1099-
If(
1100-
have_environment_systems_manager_parameters_path,
1101-
ecs.Environment(Name="IMGPROXY_ENV_AWS_SSM_PARAMETERS_PATH",
1102-
Value=Ref(environment_systems_manager_parameters_path)),
1103-
NoValue,
1032+
ecs.Environment(
1033+
Name="IMGPROXY_ENV_AWS_SSM_PARAMETERS_PATH",
1034+
Value=If(
1035+
have_environment_systems_manager_parameters_path,
1036+
Ref(environment_systems_manager_parameters_path),
1037+
If(
1038+
have_environment_systems_manager_parameters_path,
1039+
Ref(environment_systems_manager_parameters_path),
1040+
Join("", ["/", StackName]),
1041+
),
1042+
),
11041043
),
11051044
ecs.Environment(Name="IMGPROXY_USE_S3", Value="1"),
11061045
If(
@@ -1453,6 +1392,37 @@ def __init__(self, value_one: object, value_two: object) -> None:
14531392
Condition=deploy_cloudfront,
14541393
))
14551394

1395+
template.add_output(Output(
1396+
"HowToConfigure",
1397+
Description="How to configure imgproxy",
1398+
Value=Join(
1399+
"",
1400+
[
1401+
"imgproxy loads AWS Systems Manager Parameter Store parameters from the path ",
1402+
If(
1403+
have_environment_systems_manager_parameters_path,
1404+
Ref(environment_systems_manager_parameters_path),
1405+
Join("", ["/", StackName]),
1406+
),
1407+
" as environment variables at launch. For example, if you create a parameter named ",
1408+
Join(
1409+
"/",
1410+
[
1411+
If(
1412+
have_environment_systems_manager_parameters_path,
1413+
Ref(environment_systems_manager_parameters_path),
1414+
Join("", ["/", StackName]),
1415+
),
1416+
"IMGPROXY_KEY",
1417+
]
1418+
),
1419+
", it will be loaded as the IMGPROXY_KEY environment variable.",
1420+
" If you change the parameter value, you need to restart the imgproxy service to pick up",
1421+
" the new value.",
1422+
],
1423+
),
1424+
))
1425+
14561426
# ==============================================================================
14571427
# WRITE THE RESULT
14581428
# ==============================================================================

0 commit comments

Comments
 (0)